Vulnerability · Published Jun 13, 2022 · Assigned by GitHub_M
CVE-2022-29257Electron's AutoUpdater module fails to validate certain nested components of the bundle
Medium 6.6
In plain English
A medium-severity improper input validation in electron from electron. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows attackers who have control over a given apps update server / update storage to serve maliciously crafted update packages that pass the code signing validation check but contain malicious code in some components. This kind of attack would require significant privileges in a potential victim's own auto updating infrastructure and the ease of that attack entirely depends on the potential victim's infrastructure security. Electron versions 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 contain a fix for this issue. There are no known workarounds.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | electron | 15.5.0 | GHSA-77xc-hjv8-ww97 |
| npm | electron | 16.2.0 | GHSA-77xc-hjv8-ww97 |
| npm | electron | 17.2.0 | GHSA-77xc-hjv8-ww97 |
| npm | electron | 18.0.0-beta.6 | GHSA-77xc-hjv8-ww97 |
Affected products (as reported)
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/electron/electron/security/advisories/GHSA-77xc-hjv8-ww97 x_refsource_CONFIRM